Measuring Entangled Qutrits and Their Use for Quantum Bit Commitment 
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We produce and holographically measure entangled qudits encoded in transverse spatial modes 
of single photons. With the novel use of a quantum state tomography method that only requires 
two-state superpositions, we achieve the most complete characterisation of entangled qutrits to date. 
Ideally, entangled qutrits provide better security than qubits in quantum bit-commitment: we model 
the sensitivity of this to mixture and show experimentally and theoretically that qutrits with even 
a small amount of decoherence cannot offer increased security over qubits. 

PACS numbers: 42.50.Dv, 03.65.Wj, 03.67.Dd, 03.67.Mn 



Many two-level quantum systems, or qubits, have been 
used to encode information using d-level systems, or 
qudits, enables access to larger Hilbert spaces, which can 
provide significant improvements over qubits such as in- 
creased channel capacity in quantum communication Q ■ 
When entangled, qutrits (d=3) provide the best known 
levels of security in quantum bit-commitment and coin- 
flipping protocols, which cannot be matched using qubit- 
based systems Q • The ability to completely characterise 
entangled qudits is critical for applications. This is only 
possible using quantum state tomography 0, |^ . 

Entangled qudits have been realised in few physical 
systems, and only indirect measurements have been made 
of the quantum states of these systems. Qutrit entan- 
glement has been generated between the arrival times of 
correlated photon pairs, where fringe measurements were 
used to infer features such as fidelities with specific entan- 
gled states and to estimate a potential Bell violation 0. 
It is also possible to encode qudits in the transverse spa- 
tial modes of a photon, Fig.^ There have been measure- 
ments demonstrating, but again not quantifying, spatial 
mode entanglement in parametric downconversion |jj , in- 
cluding fringe measurements [ala and the violation of a 
two-qutrit Bell inequality 

USUI 

Here, we use quantum state tomography to completely 
characterise entangled, photonic qudits (both d = 2 and 
3) encoded in transverse spatial modes, measuring the 
amount of entanglement and the degree of mixture. We 
show how to use the qutrit system in a quantum bit- 
commitment protocol and investigate the experimental 
requirements for achieving the best known security Q. 
To illustrate these results, we first introduce and demon- 
strate two conceptually distinct ways of encoding infor- 
mation in transverse spatial modes, which differ in the 
behaviour of superposition states. This work constitutes 
the most complete characterisation of spatially-encoded 
qubits and qutrits and the first quantitative measurement 
of entangled qutrit states. 

The Gaussian spatial modes are a complete basis 
for describing the paraxial propagation of light [l^ . 
Two orthonormal mode families are shown in Fig. ^a): 



the Hermite-Gauss (HG rs ) and Laguerre-Gauss- Vortex 
(LGVpi). These modes are self-similar under propa- 
gation; modes of the same order experience the same 
propagation-dependent phase shift, the Gouy phase shift. 
We define degenerate qudits to be constructed from ba- 
sis states of the same order [Fig. db)]. Conversely, 
non-degenerate qudits contain states of different or- 
ders [Fig. [He)]; the different Gouy phases cause non- 
degenerate qudit superpositions to change phase as they 
propagate. 

When encoding in photon polarisation, the quantum 
state is manipulated with wave plates and selected us- 
ing a polarising beam splitter 14]. In spatial encod- 
ing, the wave-plate function is achieved with a holo- 
gram, and the beam-splitter with a single-mode fibre 
(SMF), which selects the lowest order spatial component 
(HGqo = LGVoq = G) and interferometrically rejects all 
higher order modes. A spatial mode analyser (SMA) 
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FIG. 1: (a) The first three orders of two paraxial mode fami- 
lies: the Hermite-Gauss modes (HG rs ), with r horizontal and 
s vertical lines of phase discontinuity; the Laguerre-Gauss- 
Vortex modes (LGV p i), with p ring phase discontinuities and 
a charge I phase singularity, or vortex. The mode order is 
r+s for HG r s modes and 2p+l for LGV v i modes. Superposi- 
tion states for (b) degenerate and (c) non-degenerate qubits, 
where the logical modes are respectively of the same and dif- 
ferent orders. The displaced singularity in the non-degenerate 
qubit moves around the beam centre as it propagates. 
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combines these two components with a detector. The 
hologram first converts the target mode into the mode G, 
which is then selected by the fibre [Fig. Ufa)] . All other 
modes are rejected [Fig. |2Ib)] with typical extinctions of 
~10 -3 — equivalent to standard commercial polarising 
beam splitters. We use different holograms to measure 
different states, as described below. 

Quantum state tomography requires a series of comple- 
mentary measurements on a large ensemble of identically 
prepared copies of the system Q . Rather than measure d- 
state superpositions [f| , we choose a set of measurements 
constructed from only basis states, \j), and two-state su- 
perpositions, \p + ) and \q + ), where |p ± ) = (|j)±|M]/v / 2, 
\q±)={\j)±i\k))/y/2, and j,k G {0,1,. ..d-l] Q. In 
practice, we use an over-complete set including \p~) and 
|<7 _ ), which allows more accurate normalisation when 
converting the data to measurement probabilities. We 
obtain a physical density matrix using an optimisation 
procedure the over-specification also makes the op- 
timisation less sensitive to outlying data points. Using 
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FIG. 2: Quantum state tomography of spatial modes. A spa- 
tial mode analyser (SMA) realised with a LGVb,+i hologram: 
(a) the target mode (LGVb,+i) couples into a single-mode fi- 
bre; (b) other modes (e.g. LGVbo) are rejected. The images 
are labelled with the charge of the phase singularity in the 
beam, (c) Conceptual layout for tomography. Two SMAs 
analyse the mode of the energy degenerate pairs (820±10 
nm), postselected by counting in coincidence for 100 s with 
fibre-coupled avalanche photodiodes (~ 100 counts/s). (d) 
The 8-segment analysis hologram [gsj used in all our exper- 
iments: the labels (G, R, etc.) correspond to the main spa- 
tial mode analysed by that segment. The positions (i-iii) for 
(d) degenerate and (iv-vi) for (e) non-degenerate qubits cor- 
respond, respectively, to measuring one computational basis 
state and the two equal superposition states, (|0) + i|l))/\/2 
and (|0) + |l))/v / 2. 



this two-state tomographic technique, we characterise the 
output from a Type-I down-conversion source pumped 
by a blue diode laser [Fig. EJc)]. The two SMAs image 
partial, banana-shaped sections of the cone of energy de- 
generate photon pairs and so see significant contributions 
from spatial components other than G. 

The simplest degenerate qubit encoding has first order 
logical basis states, e.g., HGio = 0, HGoi = 1. The cor- 
responding physical measurements required for tomog- 
raphy are then the states described by Padgett et al. 
|l6| : the -ffGoi-type modes with horizontal (H), vertical 
(V), diagonal (D) and anti-diagonal (A) phase discon- 
tinuities, and the LGVq,±i modes with charge ±1 phase 
singularities (right, R, and left, L). These states are mea- 
sured using 6 different plane-wave hologram segments as 
shown in Fig. E^d) [T3|. To test the performance of the 
SMA, we holographically created and measured a range 
of single qubit states using a coherent source (10 mW 
HeNe laser). In all cases, we obtained extremely high 
purities (>0.999) and fidelities with their ideal coun- 
terpart (>0.98). Fig. OUa) shows the two-photon state 
of the down-converter measured in the qubit basis: the 
state is highly entangled, the fidelity with the maximally- 
entangled (f> + Bell state is F0+=O.97. The degree of en- 
tanglement and mixture of the measured state is quanti- 
fied, respectivel y b y the tangle, T=0.90, and linear en- 
tropy, ^=0.06 Hi. 

The simplest non-degenerate qubit encoding has zero 
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FIG. 3: Measured density matrices (real parts) for: (a) en- 
tangled degenerate qubits (H = 0, V = 1); (b) entangled 
non-degenerate qubits, (G = 0, L = 1 in arm 1; G = 0, R = 1 
in arm 2); and (c) entangled non-degenerate qutrits, (L = 0, 
G = 1, R = 2), where every second row is labelled. For all 
three cases, imaginary components were <0.03. 
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(G = 0) and first order (e.g. R or L = 1) basis states. 
The basis states are measured with the appropriate holo- 
gram segments, and the superposition states are simply 
accessed by displacing the R or L singularity a distance 
from the centre of the beam [Fig. Hfe)], where ui 
is the intensity 1/e 2 point 0, . The analyser qual- 
ity is equivalent to the degenerate case. The measured 
non-degenerate, two-qubit state [Fig. E[b), T=0.65 and 
5l=0.11] has a lower tangle, reflecting the larger compo- 
nent of G in the down-conversion beam. This state has 
a high fidelity, _F=0.95, with a nonmaximally entangled 
state [13 of the form (\GG}+s\LR))/y/T+l? fore=0.60. 
The results for both types o f qu bit indicate that a Bell 
inequality could be violated [12 ]. 

We now encode a non-degenerate qutrit using basis 
states from the lowest two mode orders 0: L = 0, 
G = 1 and R = 2. Our two-state tomographic tech- 
nique enabled us to use the hologram in Fig. Eld) and 
|2Ie); the resulting measured two-qutrit state is shown 
in Fig. IHIc). This state is quite pure, with linear en- 
tropy Sl=0.18, and highly entangled. There are sev- 
eral ways to quantify the entanglement of this state. 
Given the relative populations of the basis states, we 
expect a non-maximally entangled state of the form, 
(\LR) + e\GG) + \RL))/y/2 + |e| 2 ; for £ =1.79e-°- 07ra , 
found using numerical optimisation, the fidelity between 
the ideal and measured nonmaximally entangled states is 
F=0.88. More directly, we calculate an upper bound to 
the measured entanglement of formation of 0.74 |22ll23l|. 

One advantage that entangled qutrits offer over qubits 
is increased security in cryptographic protocols such as 
quantum bit commitment (BC) and coin flipping. Quan- 
tum BC binds a sender (Alice) to one message (a bit), 
and prevents the receiver (Bob) from determining the 
message before Alice later chooses to reveal it. BC is the 
basis for the most secure known strong quantum coin- 
flipping protocols . While BC protocols with uncondi- 
tional security are impossible [2(| |27j , they can be par- 
tially secure 0. The best known BC protocols are purifi- 
cation protocols, where Alice supplies the only quantum 
system, which consists of two parts. She sends the to- 
ken subsystem to Bob to commit her bit and the proof 
subsystem later to reveal it. Maximum security in such 
protocols can be achieved by using two entangled qutrits 
for the token and proof, but not qubits. 

We now outline one procedure for using our entan- 
gled qutrit state analysed above to implement a purifi- 
cation BC protocol. Depending on her choice of bit, 
Alice should prepare two qutrits in one of the orthog- 
onal states \0) L = v / A|12)+e l *Vl — A|01) or |1) L = 
e^Vl — A|21) + \/A|10), where A is a parameter char- 
acterising the security of the protocol. To prepare such 
states using our system, Alice needs to postselect the en- 
tangled states that have no photons in one of the basis 
modes of one subsystem: e.g., consider the proof sub- 
system in arm 1: zero photons in the "2" basis mode 



yield \0)l', zero photons in the "0" mode yield In 
principle, manipulating the individual modes of the proof 
subsystem can be accomplished using a holographic in- 
terferometer in that arm. Postselection would then re- 
quire either perfect detectors or spatial-mode quantum 
nondemolition (QND) measurements. Here, however, we 
simulate this process and reconstruct the new states |28( . 
The logical states are then created by swapping the re- 
maining proof subsystem modes. Fig.0fa) and^b) show 
the two-qutrit logical states that result from this simu- 
lated state preparation step. In this simulation, the only 
imperfections in the protocol arise from the initial state, 
thus giving a bound for the usefulness of our entangled 
qutrits. 

After preparing the appropriate state, Alice then sends 
the token qutrit to Bob. Because of the entanglement 
(quantified by A), the reduced token state possessed by 
Bob is mixed, which lies at the heart of the security of 
the purification protocol. The fact that orthogonal two- 
qutrit logical states produce non- orthogonal token states 
provides some security against Bob cheating. His maxi- 
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FIG. 4: A purification bit-commitment (BC) protocol. The 
logical bits generated by Alice as described in the text: (a) 
]0}l; (b) |1}l- Insets: Bob's reduced density matrices - the 
token subsystems, (c) Plot of Alice's Control vs Bob's Knowl- 
edge Gain, o: the measured protocol; O: the closest ideal 
protocol. W and X: the best known qutrit and qubit pro- 
tocols. Y & Z: Imperfect purification protocols with token 
states of the form, p ,i = p/3 / + (1 — p) Po d f al , where Y is 
A=0.5 and Z is A=0.27. The positions for p = 0.09, 0.19, 0.29 
are marked with x (Y) and + (Z). 
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mum knowledge gain, K, is limited by the distinguisha- 
bility of these states and quantified by the trace distance. 
However, it is this partial distinguishability which in turn 
limits Alice's ability to cheat and change her bit after her 
commitment. Her maximum control, C, can be quanti- 
fied by the fidelity between the token states. Details can 
be found in Ref. The protocol is concluded by Al- 
ice sending the proof qutrit to Bob, who performs the 
orthogonal, two-qutrit projective measurement, and ei- 
ther decodes the bit {|0)l(0|, or catches Alice 
cheating. 

Figure^Jc) shows a plot of C vs K, where the bottom 
left corner represents unconditional security and the top 
right corner represents no security. The ideal token states 
for this scheme give K=X/2 and C=(l — A)/2, and vary- 
ing A produces the best known Alice-supplied security 
curve (W). The shaded region between W and X high- 
lights the area inaccessible to qubit-based, but accessible 
to qutrit-based BC protocols. The insets to Fig. QJa) 
and (b) show the reduced density matrices for the to- 
ken resulting from our initial state, which are closest to 
ideal states with A=0.27 (F~0.99). However, in spite of 
this high fidelity, if we determine C and K directly from 
the measured token states, the protocol lies just inside 
the area accessible to qubits: a direct result of the slight 
(<3%) residual population in the other mode of Bob's 
token subsystems, originating from the defects of Alice's 
original state. In other words, a two-qutrit state with 
residual populations of <1% is required to surpass the 
qubit boundary (X). 

To implement this BC protocol, Alice must be able 
to perform deterministic postselection (e.g., using QND 
measurements). This is hard. Even if she achieves this 
perfectly, we have shown that the protocol still lies in the 
qubit-acccssible regime. In our simulation, the only dif- 
ferences between our protocol and the ideal resulted from 
imperfections in the initial state. This result demon- 
strates that the requirements on the initial two-qutrit 
entangled state are extremely stringent, and that future 
theoretical work in this area should consider the critical 
role of even small amounts of mixture. 

We have performed the first full characterisation of en- 
tangled, spatially-encoded quantum states, and achieved 
the first complete measurement of an entangled, two- 
qutrit state in any encoding, using a novel quantum to- 
mography technique that only requires two-state super- 
positions. We have outlined a scheme for using this sys- 
tem to implement the best known BC protocol. With this 
measured state, this protocol would not reach maximal 
security, but we can see from the results what improve- 
ments are required. This analysis would have been im- 
possible without access to the complete two-qutrit state, 
gained through quantum tomography. 
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